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A Convex Approach to Fault Tolerant Control 
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The design of control laws for dynamic systems with the potential for actuator failures 
is considered in this work. The use of Linear Matrix Inequalities allows more freedom in 
controller design criteria than typically available with robust control. This work proposes 
an extension of fault-scheduled control design techniques that can find a fixed controller 
with provable performance over a set of plants. Through convexity of the objective 
function, performance bounds on this set of plants implies performance bounds on a 
range of systems defined by a convex hull. This is used to incorporate performance 
bounds for a variety of soft and hard failures into the control design problem. 


Introduction 

The control design of lightly damped dynamic sys- 
tems is a challenging area for incorporating fault tol- 
erance. Loss of an actuator or sensor can greatly 
degrade, or even destabilize, the closed-loop perfor- 
mance. This is particularly true for optimal control 
laws that are tuned to a specific operating condition. 
Although robust control can account for real paramet- 
ric uncertainty, in the case of full actuator failure the 
use of broadband 100% input uncertainty severely lim- 
its loop gains, and often results in conservative control 
laws. 

An alternative approach is considered here that 
makes use of the flexibility offered by posing control 
design problems as Linear Matrix Inequalities (LMIs). 
The use of LMIs in control theory has been studied 
extensively in recent years. 1 ’ 2 Of particular interest is 
the design of linear parameter varying (LPV) control 
laws, that are implicitly gain scheduled with changes 
in the plant. 3 One application of LPV control is in 
the design of fault-scheduled (FS) controllers which 
axe scheduled with measured fault parameters in the 
system. Here we examine a modification to the FS 
control design that allows for fixed controllers and re- 
moves the need for griding the parameter space. 

The design technique is tested on a simple coupled 
mass-spring-daxnper system. Although quite simple 
this system possess the same qualitative characteristics 
as more complex flexible body systems. Controllers 
are designed using the proposed LMI framework and 
analyzed under various fault conditions. These faults 
include hard failure - a complete loss of an actuator 
and soft failures - dynamically altered capability of an 
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actuator. 

Control Synthesis 

Much progress has been made in the synthesis of 
control laws as convex optimization problems, and 
software to solve such problems is becoming more 
widely available. 4-6 One benefit of this approach is 
that equations for the analysis of linear systems, can 
be written quite naturally as linear matrix inequalities. 
With the proper change of variables these analysis 
equations can be transformed directly into synthesis 
equations for controllers that meet the closed-loop ob- 
jectives. 7 This allows multi-objective problems involv- 
ing a collection H 2 or norms, as well as regional 
pole placement, passivity, and other performance ob- 
jectives. 

A second, and here more significant, benefit of us- 
ing LMIs to pose controller synthesis equations is that 
performance criteria can be simultaneously imposed 
on multiple plant models. This allows potential fail- 
ure conditions to be explicitly defined in the design 
process, and predictions made about performance un- 
der nominal, as well as degraded conditions. For soft 
failures and dynamic degradation, it is important to 
guarantee performance not only at specific conditions, 
but over an range of possible variations. The convex- 
ity of the LMI controller synthesis equations allows 
this problem of infinite constraints to be bounded by 
a finite set of conditions imposed at vertex systems. 

The basis of the control synthesis in this work is an 
H 2 design problem. That is, find K that minimizes 
\\Pi(P,K)h: where T\ is the lower Linear Fractional 
Transformation. 8,9 The augmented plant model P 
is partitioned with disturbance to performance path, 
P zwy over the actuator to sensor path, P yu , as P = 
[P zw P V n] T ■ A block diagram of the closed-loop sys- 
tem, indicating the feedback structure of the plant, 
controller, and design weightings is shown in Figure 1. 
The performance requirement is defined in terms of the 


l OF 9 


American Institute of Aeronautics and Astronautics 



AIA A-2002-4940 


weighted transfer function from disturbances to the 
performance output. Additional paths are included in 
the augmented system model to account for the cost 
of control effort, weighted by W u , and the presence 
of disturbance input at the sensors, weighted by Wv 
With constant weightings this arrangement gives the 
H 2 problem essentially the same design parameters as 
a traditional Linear Quadratic Gaussian (LQG) con- 
trol law. 10 

Solving the H-z control problem via Riccati equa- 
tions is a straightforward procedure, however, it lacks 
the ability to account for failure conditions in the de- 
sign. Calculation of the H 2 norm using LMIs involves 
finding a P > 0 and Q = Q T that minimizes Tr(Q), 
and satisfies, 


conditions represent convex constraints on the solution 
space. This has two advantages. First solutions to con- 
vex problems are numerically tractable, even with the 
large number of unknowns inherent in an output feed- 
back problem. Interior-point algorithms are available 
that can solve such problems or show that a solution 
does not exist. 

The second advantage is that convex functions, 
when evaluated over convex hulls, reach their max- 
imum at a vertex point. This means that ensuring 
these conditions over a infinite range of parameter vari- 
ation is possible by checking only a a finite set of well 
chosen vertex models. For example, if a set of un- 
knowns were found for multiple state input matrices, 
i.e. B = {B u B 2 }, then the resulting controller would 
have performance guarantees not only for the systems 
realized by (A, B\ , C y D) and (A, B 2 , O, D) but also for 
any input matrix given by, 


where (A,B,C) is a realization of the closed-loop sys- 
tem As an analysis LMI this is readily solved 

for V and Q y however, (A, S,C) is the closed-loop sys- 
tem and it contains further unknowns from the control 
law. A direct expansion of (1) yields inequalities that 
contain products of unknowns, and therefore is no 
longer convex. 

As developed in 7 a congruence transformation cou- 
pled with a substitution of variables can restore con- 
vexity with respect to a new set of unknowns. These 
unknowns are (A, #, C, D, X,Y) and are related to 
the original controller (Ajt, B k) C/ : , D k ) and Lyapunov 
term V by the following equations, 


A 

= NA k M T + NB k CX + YBC k M T 

(2) 


+ Y{A + BD k C)X 


B 

= NBk + YBDk 

(3) 

C 

= C k M T -r D k CX 

(4) 

D 

= D k 

(5) 


where MN T = (7 - XY) and V is related to A' and 
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In these new unknowns the H 2 norm condition of (1) 
can be written as the equivalent problem of minimizing 
the trace of Q subject to 
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\C Z X + D ZU C C Z +D ZU DC Q \ 

D zw = -D zu DB yw (9) 

where the terms (•)' r are implied by symmetry of the 
overall matrix. As Linear Matrix Inequalities, these 


B(q) = aBi + (1 - a)Ba, 0<a<l (10) 

This condition ensures tolerance of attenuation in ac- 
tuator gain as well as fully failed scenarios. 

Eliminating Parametric Dependence 

The design method described above yields fault- 
scheduled (FS) control laws. This is because even for 
a constant set of solution variables (A, 7), ) 

the controller still must be calculated by inversion of 
(3)-(5), yielding 

A k = N~ l (A-NB k CX -YBC k M T (11) 

-Y{A + BD k C)X)M- r 
B k = N-\B-YBD k ) (12) 

= (C-D k CX)M~ r (13) 

D k = D ( 14 ) 

This solution introduces a parametric dependence in 
the control law. If the input faults of the system are 
available for real time implementation, then the FS 
controller can be implemented. The ability to accu- 
rately measure faults in a system, however, is often 
unrealistic. Recent work has looked at sensitivity to 
errors in the scheduling parameter in an attempt to 
design robust LPV controllers that will tolerate errors 
in estimation of the fault condition. 11 

Here we seek a method to find a fixed controller 
that will tolerate rapid and unmeasured changes in 
the condition of the plant. To do this requires enforc- 
ing the performance criteria not only at the nominal 
solution condition but also within a specific neighbor- 
hood of that solution. Specifically, we consider systems 
without disturbance to performance feed-through, i.e. 
D zw ~ 0. This yields finite open-loop H 2 norms and 
strictly proper optimal controllers, i.e. D = D k = 0. 
A second, and somewhat more restrictive assumption, 
is that all fault conditions enter the plant model only 
through changes in the B matrix and these changes 
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can be bounded by the convex hull of a set of vertex 
matrices, 

B = B 0 + AB, AB e Co[AB,, (15) 
where the convex hull is defined as, 


C<j|A£ 1 ,AB,,...AB„] = Y, a ' AB " 

. <“> 

V ctj > 0, ^ <*i = 1; 

1—1 

Under these conditions the terms (B,C,D,X,Y) 
are independent of changes in B and thus remain con- 
stant with failures. It is only the term A that must 
change with the plant changes. Normally, the term 
A is held constant by corresponding changes in the 
control law achieved through gain scheduling. The 
alternative pursued below is to pose additional LMI 
equations that explicitly account for potential changes 
in A. The norm bounds will hold for the variations in 
A if synthesis LMIs are posed at the extremal values 
of A. For a single failure mode B = {B 0) B 0 + LB\ } 
the synthesis LMIs would be 


(18) is modified as follows 

AX + {B 0 + AB{)C + {Y 
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Bl 
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( 20 ) 


< 0 


The value of matrix C, obtained from the LMI 
synthesis in the first step, and referred to as C opi) 
is then fixed and a second robust LMI problem 
is solved, using the degrees of freedom in the re- 
maining variables. The synthesis LMI is defined 
by Eqs. (17) and (19), along with a modified Eq. 

HR). 
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where the variation terms involving ABi has been, 
included in (18). These conditions will provide H 2 
performance with a fixed control law under both the 
nominal and failed system conditions. However, the 
synthesis problem is no longer convex as the product 
of two unknowns, Y and C, appear in (18). 

To work around the loss of convexity a two stage 
approach is taken for the design. 


• A robust fault-scheduled control law is first for- 
mulated in the LMI framework. For the single 
failure mode example, this means that in the syn- 
thesis LMI Eq. (17) is used as is, however Eq. 


Although this sacrifices the full sense of optimality 
in the robust controller it does provide a quantitative 
measure of the performance degradation incurred in 
accommodating the failure case. Furthermore, it al- 
lows a different set of objectives to be imposed in the 
second stage. This can be used to enforce as a con- 
straint the minimal performance level under failure, 
and optimize on the nominal, or if desired constrain 
the nominal and optimize for failure conditions. The 
freedom to tailor a problem formulation to meet such 
design criteria has powerful engineering significance, 
and is one of the advantageous of feasible LMI design 
methods versus more conventional robust and optimal 
control. 

Defining Vertex Points 

Thus far, the paper has described an LMI- 
based synthesis procedure for designing fixed fault- 
accommodating controllers which can handle actuator 
faults/failures. The formulation covers both hard fail- 
ures, in the form of the total loss of one actuator, as 
well as soft failures, which represents a degradation 
in the actuator performance, e.g., loss of bandwidth. 
As mentioned earlier, the input uncertainties in the 
LMI framework need only be considered at the ver- 
tex points of the parameter space. This is because 
convex functions, when evaluated over convex hulls, 
reach their maximum at a vertex point. The num- 
ber of vertex points generally depends on the nature 
of the fault/failure being considered. To elaborate on 
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this, consider an example of a system with two inputs. 
First consider a hard failure case, wherein one actua- 
tor has totally failed. There are three distinct vertex 
points that need to be considered in this case. These 
are: (a) Both actuators functional; (b) Actuator one 
has failed; and (c) actuator two has failed. Mathemat- 
ically, these case are described by the following input 
matrices. 

Bo = B o] B i = [0 Bl\, B 2 = [B\ 0] (22) 

where B\ and B'l represent the first and second col- 
umn of B 0i respectively. The soft failure case is a bit 
more involved because both gain and phase changes 
are possible. As mentioned previously, one of the as- 
sumptions of the proposed approach is that all fault 
conditions enter the plant through the state input ma- 
trix B. To accommodate this condition, an arbitrary 
number of vertex points are chosen for each actuator 
failure. Moreover, corresponding to each vertex point, 
an LTI filter (with arbitrary dynamics) is selected and 
placed in series (at the input) with the plant. These 
filters represent designer-specified soft failure modes 
(note that even hard failures may be defined as well) , 
whose combination determines the degree of soft fail- 
ure allowed in the design process. One possible way 
of implementing the soft failure filters is to increase 
(for each actuator) the number of the plant’s inputs 
to the number of independent soft failure filters for 
that actuator by duplicating the proper column of the 
B 0 matrix. In the two-input example, lets assume that 
for each actuator two independent soft failure modes 
are being contemplated. Assume that these failures 
are represented by filters Fn(s), J t? i 2 ( s ) ; P' 2 i{s)-> 311 ^ 
ir 22 ( s ). Let P{s) denote the plant with inflated inputs. 
Here, P(s) is identical to the nominal plant except it 
has two additional inputs, identical to the nominal in- 
puts, i.e., B = \B 0 B 0 }. Now, an augmented plant 
p( s ) may be defined by placing the filter dynamics in 
series with P(s). 

P(s) = P{s) diag[F u (s) Fn($) F 2 i(s) F 22 M] (23) 

Now that the soft failure filter dynamics are included 
in the plant dynamics, the vertex points for the LMI 
design may be defined by appropriately choosing a 
constant distribution matrix Li for each vertex i to 
incorporate a specific failure scenario. Note that the 
matrix Li must be dimensioned such that it reduces 
the number of inputs back to the original value. 

Example Problem 

The proposed fault tolerant method is demonstrated 
on a simple mass-spring-damper system. As shown 
in Figure 3, three serially connected masses compose 
the system model, with the following parameters, each 
mass is 1 Kg, each spring is 100 N/m, and each damper 
is 0.25 Ns/m. A velocity sensor is assumed to provide 


velocity measurements from mass no. 1. Two force 
actuators are assumed, at mass no. 1 and 3, to provide 
control forces. The model can be explicitly written. 
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(24) 


The failures of interest are soft failures, in terms 
of gain attenuation or phase changes, in any single 
actuator, up to hard failures, i.e., a full loss of any 
single input. The spring-mass system is assumed to 
be disturbed by an unmeasured force applied to the 
second mass. The goal of the controller is to minimize 
the H 2 norm from this input to a performance metric 
which is the sum of the the displacement and velocity 
of the third mass. This represents the ability of the 
disturbance to drive energy into the system. The opti- 
mization is balanced by including both sensor noise, as 
additional weighted disturbances, and a control effort 
penalty. This arrangement is showm in the augmented 
plant of Figure 1. 

To accommodate both soft and hard failures in the 
same parameterization, first the two inputs of the sys- 
tem were increased to four by duplicating the two 
nominal inputs. Then, failure dynamics filters were 
appended to the plant at the inputs. Two types of 
failure dynamics were included. The first filter dy- 
namics was chosen to represent an actuator dynamics 
with significantly reduced bandwidth, i.e., a low pass 
filter, as follows: 


The second failure filter w r as chosen to be the comple- 
ment of the first (in the lower frequencies) along with 
a roll-off at 10 Hz. 


p 2 (s) = (1-F, (a)) 


20?r 

S -b 207T 


(26) 


It is interesting to note that the combination of the two 
filters gives the dynamics of a fully functional actua- 
tor with a roll-off at 10 Hz. Hence, these dynamics can 
serve to represent both soft and hard failures. More- 
over, three distinct design criteria may be considered 
with this formulation. They are designs for soft fail- 
ure only, hard failure only, and soft and hard failures. 
The frequency response coverage provided by the ap- 
pended failure dynamics, in terms of gain attenuation 
and phase changes, for each design criteria is illus- 
trated in Figure 4. As expected, the hard failure case 
(Figure 4(a)) allows for actuator gain variations be- 
tween 0 and 1 with no variations in phase. The soft 
failure case does allow' for phase variations as well as 
some gain variations. The combined case (Figure 4(c)) 
allows both gain and phase variations. 

Let the columns of the expanded B matrix corre- 
spond to input no. 1 with F\(s), input no. 1 with 
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F 2 (s), input no. 2 with Fi(s), and input no. 2 with 
F 2 (s ), respectively. Then, for the hard failure case, 
there were three vertex points considered; the nom- 
inal with no failure (all 4 columns of the B matrix 
in tact), and one with each of two actuators removed 
from the B matrix (the first two columns of the B 
matrix nulled for actuator no. 1 failure, and the last 
two columns nulled for actuator no. 2 failure). When 
equations (17)- (21) are solved for each of these four 
conditions they provide a fixed control law with guar- 
anteed H 2 performance for hard or soft failure of any 
one actuator. The bounds are actually guaranteed over 
a convex shape as shown in Figure 2, where the origin 
is the nominal condition and each independent axis 
represents the percentage degradation in a given actu- 
ator. The control design imposes an H 2 norm bound 
for every system within this space of potential failures. 
For the soft failure only case, there were five vertex 
points; the nominal with no failure (all 4 columns of 
the B matrix in tact), and one with each soft failure 
mode of an actuator (one column of the B matrix ze- 
roed out at a time). For the combined soft and hard 
failure case, there were seven vertex points considered. 
These are those included in the soft failure case along 
with two additional vertex points for total failure of 
one of the two actuators (the first two columns of the 
B matrix nulled for actuator no. 1 failure, and the last 
two columns nulled for actuator no. 2 failure). Note 
that the guarantees indicated for the hard failure case 
(over a convex shape similar to Figure 2) also holds 
for the soft failure and combined cases as well. 

Numerical Results 

Three separate control laws were designed. For 
reference an H 2 optimal controller was designed via 
Riccati equations for the nominal unfailed system. A 
fault-scheduled (FS) controller was also designed by 
solving the LMI conditions of (17)- (20). The imple- 
mentation of this controller depends upon measure- 
ment of the failed condition of the plant as it must 
be interpolated in real-time. Finally, using the LMI 
conditions of (17)- (21) a fixed controller was designed. 
Although based in part on the solution for the nom- 
inal plant FS controller, this fixed control law had 
provable performance bounds over the entire range of 
single-fault failures. The LMI problems were posed 
using ” YALMIP” , 6 which is an LMI parser for use in 
the MATLAB environment. The LMI conditions were 
solved using ”SeDuMi”, 5 a sparse convex solver for 
MATLAB environment. 

The three design cases were first evaluated for three 
failure cases: hard failures only, soft failures only, and 
combined hard and soft failures. The results are sum- 
marized in Table 1-3. In all three cases, it is observed 
that although the straight H 2 control law has the best 
performance on the nominal system, this performance 
is not maintained for most of the failure conditions. 


In fact, in all three cases the H 2 controller is unstable 
with the failure of actuator no. 1. This is to be ex- 
pected as its design does not consider any failures. The 
predicted (design) H 2 norms for the FS and convex- 
hull controllers are typically more conservative than 
their actual norms, mainly due to the use of a single 
Lyapunov matrix in the multi-vertex LMI formula- 
tion. This conservatism is easily observed in Tables 
1-3. The performance of the FS and convex-hull con- 
trollers are slightly worse than the H 2 for the nominal 
plant (no failure). However, they are fully stable and 
maintain a good performance through different soft 
and hard failure scenarios. As mentioned before, the 
FS controller requires real-time measurement of the 
failure-state, and thus is not feasible for most appli- 
cations. The fixed gain convex-hull control law has a 
higher bound than the FS control law, but the perfor- 
mance is similar (and in many cases even better) and 
it has the significant advantage of not requiring knowl- 
edge on the failure state of the system. These results 
are also illustrated graphically in Figures 5-7. Here, 
singular value plots of the transfer function from dis- 
turbance to performance output are provided for the 
three failure scenarios. A significant degradation in 
the first mode attenuation is observed in the straight 
H 2 control, particularly for hard and combined failure 
modes. Also, both the FS and convex-hull controllers 
exhibit a loss of performance in the second mode for 
the hard and combined failure modes. This is the cost 
of ensuring robustness against total failure in any one 
actuator. It should be emphasized that these plots 
may only be used as a ways of observing trends in 
the frequency domain, and are not suitable to indicate 
closed-loop instabilities. Hence, closed-loop insatiabil- 
ities with the H 2 controller, although there, cannot be 
seen in these plots. 

Finally, a Monte Carlo analysis of the performance 
of these three controller were performed. A set of three 
analysis, one for each type of failure considered, were 
conducted. In each of these analysis, 500 points were 
randomly chosen in the convex hull formed by the ver- 
tex points in each design, and then the H 2 norms were 
computed. The results of these analysis are summa- 
rized in Figure 8, wherein histograms of the H 2 norms 
are illustrated for each of the three controllers and each 
of the failure cases. The range of variations for each 
controller is provided in the legends. In the combined 
failure scenario, the range of variations of the H 2 norm 
with the straight H 2 controller is 0.26 - oc, while that 
range with the convex-hull controller is 0.40 - 0.46. 
These results clearly demonstrate the effectiveness of 
the proposed fault- accommodating control technique. 

Concluding Remarks 

Control of flexible systems subject to degradation or 
total failure of actuators was considered. A Linear Ma- 
trix Inequality framework was developed to synthesize 
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LQG FS Convex 

Design 
No Failure 
Act.-l, Hard Failure 
Act.-2, Hard Failure 

0.261 0.656 0.681 

0.261 0.359 0.477 

00 0.624 0.501 

1.787 0.608 0.443 


Table 1 Predicted bounds and closed-loop H i 
norms under hard-failure design. 



LQG 

FS 

Convex 

Design 

0.261 

0.356 

0.627 

No Failure 

0.261 

0.267 

0.345 

Act.-l, Soft-fail (low) 

0.389 

0.267 

0.332 

Act.-l, Soft-fail (high) 

00 

0.276 

0.363 

Act .-2, Soft-fail (low) 

0.336 

0.270 

0.368 

Act. -2, Soft-fail (high) 

0.369 

0.290 

0.361 


a fixed-gain controller that had known H 2 norm per- 
formance bounds under a variety of input faults. These 
faults included soft failures, in the form of gain atten- 
uation and phase changes, as well hard failures. The 
proposed approach was applied to the design of fault- 
tolerant control of a simple three degrees-of-freedom 
system. The benefits of the fault- tolerant design over 
conventional H 2 approach were clearly demonstrated. 
Finally, the proposed approach can easily be extended 
to deal with sensor failures/faults. 
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Table 2 Predicted bounds and closed-loop Hi 
norms under a soft-failure design. 



LQG 

FS 

Convex 

Design 

0.261 

0.745 

0.810 

No Failure 

0.261 

0.338 

0.439 

Act.-l, Soft-fail (low) 

0.389 

0.294 

0.439 

Act.-l, Soft-fail (high) 

00 . 

0.519 

0.433 

Act.-l, Hard Failure 

00 

0.599 

0.464 

Act.-2, Soft-fail (low) 

0.336 

0.487 

0.439 

Act. -2, Soft-fail (high) 

0.369 

0.474 

0.444 

Act. -2, Hard Failure 

1.787 

0.622 

0.463 


Table 3 Predicted bounds and closed- loop Hi 
norms under a combined-failure design. 


Sensor Noise 



Fig. 1 Block diagram of the Hi problem formula- 
tion 


Actuator 2 


100 % 



Fig. 2 Schematic of bounded failure-space, i.e. 
the range of actuator attenuation for which design 
bounds remain valid. 
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(a) Potential Actuator Hard Failures 


Disturbance 
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Fig. 3 Schematic of the example spring-mass- 
damper system 



5 10 
Hertz 



Hertz 

(b) Potential Actuator Soft Failures 




(c) Potential Actuator Combined Failures 

Fig. 4 Frequency Response of single actuator 
(Nominal x’s) under random failures (solid lines) 
for hard soft and the combined failure cases. 
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(a) Fixed H 2 optimal design (a) Fixed H 2 optimal design 






(c) Fixed Convex-Hull design 


(c) Fixed Convex-Hull design 


Fig. 5 Performance of open and closed-loop sys- Fig. 6 Performance of open and closed-loop sys- 
tem under nominal and cases of full hard failure. tern under nominal and cases of full soft failure. 
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Perlormance Norm of Closed-Loop System 
(a) Randomly sample systems with hard failures 


0.4 




C3E — 1 — 

-o- LOG - Nominal Performance 
FS - Perlormance Bound 
CVX - Perlormance Bound 
| LOG: Norm Range=[Q.26H 
FS: Norm Range=[0. 27,0. 29] 

| CVX: Norm Range=[0 33.0.37) } 


0.2 0.4 0-6 0.8 

Performance Norm of Closed-Loop System 

Qamnle systems with soft failures 



(c) Fixed Convex-Hull design 

Fie 7 Performance of open and closed-loop sys 
tem under nominal and cases of full combined fad- 

ure. 
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(c) Randomly sample systems with combined failures 

Fig. 8 Monti-Carlo style performance of random 
sampled systems under various failure conditions. 
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